{"id":"CVE-2025-60020","aliases":["DEBIAN-CVE-2025-60020","DSA-6012-1","EUVD-2025-30967","GHSA-5q89-432m-p2wv","UBUNTU-CVE-2025-60020","USN-8359-1"],"status":"published","title":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving...","description":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00267,"percentile":0.19036,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-23"],"published":"2025-09-24T00:00:00Z","modified":"2026-09-01T20:05:55Z","fixes":[{"ecosystem":"Debian:12","package":"nncp","fixed_in":["8.8.2-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nncp","fixed_in":["8.11.0-4+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nncp","fixed_in":["8.12.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nncp","fixed_in":["8.5.0-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nncp","fixed_in":["8.10.0-8ubuntu0.3+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nncp","fixed_in":["8.11.0-4+deb13u1build0.25.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.2-3+deb12u1"}]}],"versions":["8.8.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.0-4+deb13u1"}]}],"versions":["8.11.0-4"]},{"source":"osv","ecosystem":"Debian:14","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-1"}]}],"versions":["8.11.0-4"]},{"source":"osv","ecosystem":"Debian:12","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.2-3+deb12u1"}]}],"versions":["8.8.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.0-4+deb13u1"}]}],"versions":["8.11.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-1ubuntu0.1+esm3"}]}],"versions":["7.7.0-4","8.0.0-1","8.0.2-1","8.5.0-1","8.5.0-1ubuntu0.1","8.5.0-1ubuntu0.1+esm1","8.5.0-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0-8ubuntu0.3+esm3"}]}],"versions":["8.8.2-4build1","8.9.0-1","8.10.0-3","8.10.0-4","8.10.0-5","8.10.0-6","8.10.0-7","8.10.0-8","8.10.0-8ubuntu0.1","8.10.0-8ubuntu0.2","8.10.0-8ubuntu0.2+esm1","8.10.0-8ubuntu0.3","8.10.0-8ubuntu0.3+esm1","8.10.0-8ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.0-4+deb13u1build0.25.10.1"}]}],"versions":["8.11.0-3","8.11.0-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-1ubuntu0.1+esm3"}]}],"versions":["7.7.0-4","8.0.0-1","8.0.2-1","8.5.0-1","8.5.0-1ubuntu0.1","8.5.0-1ubuntu0.1+esm1","8.5.0-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0-8ubuntu0.3+esm3"}]}],"versions":["8.8.2-4build1","8.9.0-1","8.10.0-3","8.10.0-4","8.10.0-5","8.10.0-6","8.10.0-7","8.10.0-8","8.10.0-8ubuntu0.1","8.10.0-8ubuntu0.2","8.10.0-8ubuntu0.2+esm1","8.10.0-8ubuntu0.3","8.10.0-8ubuntu0.3+esm1","8.10.0-8ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nncp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.11.0-4+deb13u1build0.25.10.1"}]}],"versions":["8.11.0-3","8.11.0-4"]}],"products":[{"vendor":"nncp","product":"nncp"}],"references":[{"url":"http://www.nncpgo.org/Release-8_005f12_005f0.html","tags":["report"]},{"url":"http://lists.cypherpunks.su/archive/nncp-devel/CAO-d-4riai9EZx4gVfekow-BCtTn07k8BB1ZdsopPVw=scWD1A@mail.gmail.com/T/#md678a00df1020bb811f47f42ef33c54b789cddd7","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60020"},{"url":"https://github.com/advisories/GHSA-5q89-432m-p2wv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-60020","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-60020","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-60020","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8359-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-60020","description":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.","status":"published","published":"2025-09-24T00:00:00Z","modified":"2025-09-24T14:05:06.978Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-30967","description":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.","status":"published","published":"2025-09-24T00:00:00Z","modified":"2025-09-24T14:05:06Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:40.063213Z"}],"ghsa":[{"id":"GHSA-5q89-432m-p2wv","title":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving...","description":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.","status":"published","published":"2025-09-24T15:31:13Z","modified":"2025-09-24T15:31:14Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:03:44.74353Z"}],"nvd":[{"id":"CVE-2025-60020","description":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.","status":"published","published":"2025-09-24T13:15:36.953Z","modified":"2026-06-17T09:49:13.57Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:11:32.559087Z"}],"osv":[{"id":"DEBIAN-CVE-2025-60020","description":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.","status":"published","published":"2025-09-24T13:15:36.953Z","modified":"2026-09-01T20:05:55.495246278Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-60020","description":"nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.","status":"published","published":"2025-09-24T13:15:00Z","modified":"2026-06-01T19:00:23.48353308Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DSA-6012-1","title":"nncp - security update","status":"published","published":"2025-09-26T00:00:00Z","modified":"2025-09-26T22:16:54.13378Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"USN-8359-1","title":"nncp vulnerability","description":"It was discovered that NNCP did not properly sanitize file paths\nin packet data during file requesting and file saving operations. A\nremote attacker could possibly use this issue to read or write\narbitrary files outside of the intended directory.","status":"published","published":"2026-06-01T15:04:39Z","modified":"2026-06-01T20:32:56.633545568Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}